Efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof

Abstract

The application discloses a kind of high-efficiency pixel-level dynamic image auditing methods in decentralized storage based on zero-knowledge proof, comprising: pre-processing stage: the method parameter required for subsequent stage is generated and stored by processing image file, and the authentication element and snapshot information based on file content;Image auditing stage: the challenge parameter required for auditing process is generated using pseudo-random function, the auditing task is executed based on challenge parameter, and the evidence of auditing process is generated, and the correctness of auditing result is verified;Image update stage: the update of semantic level is executed based on operation parameter, and the evidence of update process is generated, and the correctness of update operation is verified;The application aims to reduce the computing burden of data owner, especially suitable for data owner with limited computing resources in decentralized storage environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security in decentralized storage systems, and in particular to an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof. BACKGROUND

[0002] Decentralized storage systems are increasingly popular due to their ability to distribute data across multiple nodes, improving data availability, fault tolerance, and resistance to censorship. By eliminating single points of failure, decentralized storage provides a powerful data management platform that not only makes information more secure from centralized attacks but also easier to access from different geographic locations. These features make decentralized storage an attractive alternative to traditional centralized systems, especially in environments where high security and data redundancy are required.

[0003] However, protecting data security within decentralized storage systems presents unique challenges. Since data is not stored in a centralized location, it is crucial to ensure that data remains unchanged across nodes. The main concern is to ensure that data is not modified without authorization after initial storage, and the decentralized nature further exacerbates the protection of data integrity. Therefore, a strong auditing mechanism is essential to maintain data integrity and security. One important branch of the current decentralized storage auditing field is to support data dynamics in the auditing method, where data and the corresponding audit certificates need to be updated. However, existing dynamic auditing solutions face two important problems in this regard.

[0004] First, these solutions only handle block-level updates, which regenerate the audit certificates for the corresponding updated binary blocks within the file. However, block-level dynamic auditing is very counterintuitive, as files like images are semantically updated based on pixels rather than binary bits. Second, when modifying image files, data owners in existing methods must recalculate the audit certificates associated with the modified data blocks in the image file. This approach is not only impractical in real-world applications, but also depletes the data owner's local resources due to the additional computational burden of recalculating or updating a large number of certificates. SUMMARY

[0005] The purpose of the present application is to propose an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, which allows data owners to update audit certificates directly based on pixels without the need to divide image files into data blocks for comparison; this method aims to reduce the computational burden of data owners, especially for data owners with limited computing resources in a decentralized storage environment.

[0006] To achieve the above object, the technical scheme adopted by the present application is: a high-efficiency pixel-level dynamic image auditing method in a decentralized storage based on zero-knowledge proof, comprising the following steps:

[0007] Step 1, preprocessing stage: processing the image file to generate and store the method parameters required in the subsequent stage, and the authentication meta and snapshot information based on the file content;

[0008] Step 2, image auditing stage: using a pseudo-random function to generate challenge parameters required in the auditing process, performing an auditing task based on the challenge parameters, and generating evidence of the auditing process, and verifying the correctness of the auditing result;

[0009] Step 3, image updating stage: performing semantic-level updating based on the operation parameters, and generating evidence of the updating process, and verifying the correctness of the updating operation.

[0010] As a further improvement of the present application, in step 1, the method of generating the method parameters specifically comprises the following steps:

[0011] A, splitting the image file: the data owner splits the image file I into multiple image blocks {Ii};

[0012] B, selecting a generator: selecting a generator g and h in a cyclic group G1; in order to use a polynomial commitment scheme, randomly selecting a commitment opening point o and a private value χ, and calculating public parameters where the public parameters N P is the degree of the polynomial P(x);

[0013] C, generating auxiliary verification information: for each image block I i , generating auxiliary verification information μ i , where

[0014] D, creating a ZKP arithmetic circuit: based on different image operations, creating a ZKP arithmetic circuit φ for image dynamic auditing, and generating a key pair (pk i , vk i , pk d , vk d ), which is used to participate in the subsequent evidence generation and verification link;

[0015] E, generating a convolution kernel: generating a set of convolution kernels {A i} for pixel representation of the image, where i∈[0, N P -1], and using a random obfuscation factor α to prevent direct exposure;

[0016] F, storing verification information: the image owner stores g α locally.

[0017] As a further improvement of the present application, in step D, the creation method of the ZKP arithmetic circuit is specifically as follows:

[0018] The storage service provider DSP selects different circuits according to the request of the image owner, performs pixel-level update on the locally stored original image, and provides proof of the entire update process; then sends the proof to the image owner for verification; a circuit module is designed to represent the original image, that is, to perform an audit on the original image, and to operate on the original image to obtain its correct representation, and the representation information is sent to the image owner for verification.

[0019] As a further improvement of the present application, the ZKP arithmetic circuit specifically includes:

[0020] Update sub-circuit: for pixel-level processing of the original image according to different operation parameters;

[0021] Representation sub-circuit: for operating on the original image to obtain a representation closely related to the original image.

[0022] As a further improvement of the present application, in step 1, the generation method of the authentication meta based on file content and snapshot information specifically includes the following steps:

[0023] a. The image owner divides each large image block I i ∈Iinto NP×NH×NC small pixel matrices locally, where I i ={I i，0,0 , I i，0,1 ,..., I i，0,NC×NH-1 ,..., I i，NP-1,NC×NH-1}; each group of NH pixel matrices is compressed to obtain a hash matrix H i ={H i，0,1 ,..., H i，0,NC-1 ,..., H i，NP-1,NC-1}, where H i，j，l represents the result of the hash operation H(I i，j，l×NH ,..., I i，j，(l+1)NH-1 ), j∈[0, NP-1], l∈[0, NC-1];

[0024] b. Convolution operation: using a convolution kernel of size NC to perform weighted aggregation on the hash matrix, obtaining convolution coefficients C i ={C i，0 , C i，1 ,..., C i,NP-1}, where C i , m=Conv({H i}, {A i}), Conv denotes a convolution operation performed on {H i} using {A i} as a kernel;

[0025] c. Polynomial representation: Represent each image block I i as a polynomial P i (x) = C i，0 + C i，1 x + C i， 2x 2 +... + C i，NP-1 x NP-1 , resulting in a commitment value P i (o), where the commitment opening point o is used, the image owner computes the corresponding data authenticator for each image block as

[0026] d. Computing snapshot information: Using the generated authentication meta, compute snapshot information Finally, send the file {I i}, data authenticator {τ i}, and snapshot information sn to the service provider DSP.

[0027] As a further improvement of the present application, in step 2, the generation of evidence of the audit process specifically includes the following steps:

[0028] (1) Image owner initiates challenge: The image owner generates two random keys λ1 and λ2, and specifies the number of image blocks I that need to be checked; then, the image owner sends (λ1, λ2, I) to the data storage provider DSP;

[0029] (2) DSP generates challenge set: The DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ); where i is the index of the image block, generated using a pseudo-random permutation function π λ1 (k) ; η i is a random coefficient generated by a pseudo-random function f λ2 (k) ; the DSP accepts the challenged image blocks {Ii} and the random coefficient η i , and a convolution kernel matrix called αAi, used to process the image blocks;

[0030] (3) DSP computes proof π: The DSP computes the proof π using the image audit circuit Ψ: π ← Prove Ψ (pk d , {αA i}, Ψ, {I i} i∈Ω , {η i} i∈Ω , Ca ), where Ca is the linear polymerization coefficient

[0031] (4) DSP generates auxiliary proof ω τ : DSP does not challenge the image block I j Generate auxiliary proof ω τ : where,

[0032] (5) DSP sends all results to the image owner: DSP packs the calculated proof π and auxiliary proof ω τ into a whole proof Prf and sends it to the image owner.

[0033] As a further improvement of the present application, in step 2, the smart contract SC performs verification operations to verify the correctness of the audit results, by verifying the proof information sent by the DSP to determine whether the DSP has performed correct audit operations according to the challenge, which specifically includes the following steps:

[0034] 1) Generate challenge set and reconstruct proof: After receiving the proof, the SC first uses the same challenge parameters (λ1, λ2, I) to regenerate the challenge set Ω to ensure that it is consistent with the DSP's calculation results;

[0035] 2) Verify the correctness of the ZKP circuit: SC uses the circuit verification key vk d , proof π and public witness Ca to verify whether the ZKP circuit Ψ is correct: to ensure that there is no error calculation;

[0036] 3) Verify the calculation result of the circuit: SC uses the locally stored public parameters γi and g α to verify the calculation result of the circuit to ensure the correctness of the calculation result:

[0037] 4) Verify the auxiliary proof using auxiliary verification information μ: by formula SC ensures that the unchallenged data block is also correct; if all verification formulas are true, the proof process passes and the data integrity is confirmed; if any verification step fails, the SC will report failure and terminate the audit process.

[0038] As a further improvement of the present application, in step 3, the evidence of generating the update process specifically includes the following steps:

[0039] ① After receiving the modification information including the image I, the proof parameter λ3, the operation type op and the operation parameter, the DSP loads the original image I, and selects the appropriate dynamic update circuit φ opperform subsequent calculation; then, the DSP determines the set Δ = {(i, η i )} for the specified image I, where i is the index of the image block {I i}, and η i is the random coefficient corresponding to the index;

[0040] ②selecting a dynamic update circuit: according to the operation type op, selecting an appropriate dynamic update circuit φ op , and loading the original image I;

[0041] ③obtaining the convolution coefficient C C i，j {i∈Δ,j∈[0,N P -1] of the current image I, and constructing the polynomial and obtaining the aggregated coefficient C a ;

[0042] ④using the dynamic update circuit φ op , according to the original image I, the update image I', the coefficient C a , and the blinded convolution kernel matrix αA i , the DSP executes the dynamic update circuit φ o p, and obtains the circuit proof:

[0043] ⑤calculating the auxiliary proof:

[0044]

[0045] Then, the DSP sends the auxiliary proof ω τ , the circuit proof π, the coefficient information C a , and the authentication meta τ {i} of the image data to the data owner for verification.

[0046] As a further improvement of the present application, in step 3, verifying the correctness of the update operation specifically includes the following steps:

[0047] i. using the verification key of the circuit to verify the dynamic update circuit calculation: If the verification is passed, it means that the image pixel operation performed by the DSP is consistent with the result executed locally by the image owner, and the correctness of the operation is verified;

[0048] ii. verifying the coefficient information sent by the DSP, so as to determine whether the DSP has operated on the original data, which is equivalent to the verification of the audit process:

[0049]

[0050] iii. checking the auxiliary proof simultaneously:

[0051]

[0052] If all the equations are true, the update verification passes.

[0053] The present application provides an efficient pixel-level dynamic image auditing method in decentralized storage. The decentralized storage auditing method aims to ensure data security in dishonest decentralized storage providers, however, how the auditing process supports efficient dynamic data updates has always been a serious challenge. Existing dynamic auditing methods can only handle block-level updates, and require semantic changes to be converted into binary changes, in addition, existing dynamic auditing methods require data owners to recalculate auxiliary auditing information, adding additional burden to data owners. The present application proposes an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, which can support semantic-level updates in the auditing process, while eliminating the dynamic operation overhead generated by the data owner side auditing. Experimental results show that the scheme has advantages in storage overhead and computational overhead.

[0054] The beneficial effects of the present application are:

[0055] The present application aims to improve data integrity and security through innovative methods, providing more effective dynamic auditing solutions for decentralized storage systems. Specifically, the innovations of the present application mainly focus on the following aspects:

[0056] 1. The present application proposes an efficient pixel-level dynamic auditing method for decentralized storage. By integrating polynomial commitment and convolution into the authenticator construction, the present application also designs a lightweight image authenticator based on pixels, which directly maps image pixels to the authenticator.

[0057] 2. The present application further designs a non-owner dynamic mechanism, which eliminates the additional overhead in dynamic auditing by utilizing zero-knowledge proof technology. The present application constructs a dynamic update circuit through zero-knowledge proof, proving the update and representation of images in the authenticator. Not only can it record and guarantee the image update process, but also can prove the effectiveness of the original image through the circuit and the authenticator. Therefore, by ensuring the dynamic process of auditing through zero-knowledge proof in DSP, the dynamic operation overhead generated by data owners due to auditing can be completely eliminated.

[0058] 3. Through extensive experimental evaluation, the present application outperforms existing technologies in auditing performance, with a 210-fold increase in dynamic update speed. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 is a system structure diagram of an embodiment of the present application;

[0060] Figure 2 To generate a schematic diagram for the verification element in the embodiment of the present application;

[0061] Figure 3 To generate a schematic diagram for the image update in the embodiment of the present application;

[0062] Figure 4 To generate a schematic diagram for the dynamic update circuit design in the embodiment of the present application. DETAILED DESCRIPTION

[0063] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0064] Embodiment 1

[0065] As shown in the figure, an efficient pixel-level dynamic image auditing method in a decentralized storage based on zero-knowledge proof, which is divided into two stages: 1. Image auditing stage 2. Image update stage, before the two stages, a preprocessing stage is also needed to generate the parameters and data required in the process. The implementation steps are as follows: Figure 1 Step (1) Setting stage: generate and store the method parameters required in the subsequent stage;

[0066] Step (2) Preprocessing stage: generate and store authentication elements and snapshot information based on file content;

[0067] Step (1), generate the method parameters and secret keys required in the subsequent stage, specifically:

[0068] 1.1) Split the image file: the data owner splits the image file I into multiple image blocks {Ii}, and the subsequent operations are all based on image blocks.

[0069] 1.2) Select generator: select generator g and h in cyclic group G1. In order to use the polynomial commitment scheme, randomly select commitment opening point o and private value χ, and calculate public parameters

[0070] Where the public parameters P N P is the degree of the polynomial P(x). 1.3) Generate auxiliary verification information: for each image block I i , generate auxiliary verification information μ i , where

[0071]

[0072] 1.4) Create ZKP arithmetic circuit: based on different image operations (such as image flipping, cropping, grayscale, etc.), create ZKP arithmetic circuit φ for image dynamic auditing, and generate their key pairs (pk i , vk i, pk d , vk d ), the key pair will participate in the subsequent evidence generation and verification process. The specific design of the ZKP circuit is shown below:

[0073] The DSP (Decentralized Storage Provide) selects different circuits according to the request of the image owner, updates the locally stored original image at the pixel level, and provides proof of the entire update process. Then send the proof to the image owner for verification. However, this circuit cannot guarantee that the original image input into the circuit meets the requirements of the image owner. Therefore, this method also designs a circuit module to represent the original image, that is, to perform an audit on the original image, mainly to manipulate the original image to obtain its correct representation. Finally, this representation information is sent to the image owner for verification. In the actual circuit implementation, this method divides these functions into two sub-circuits: update sub-circuit and representation sub-circuit.

[0074] Update sub-circuit: responsible for pixel-level processing of the original image according to different operation parameters. This design allows the image owner to simply send operation parameters, and all logical operations for updating the authentication element are implemented by the remote DSP, effectively reducing the operational burden of the image owner.

[0075] Representation sub-circuit: mainly manipulates the original image to obtain a representation closely related to the original image. By verifying this representation, the image owner can initiate an audit-like operation on the original image to determine whether the original image in the circuit is correct. Note that the representation sub-circuit can also participate in the image audit phase to generate evidence.

[0076] 1.5) Generate convolution kernel: In order to achieve pixel-level update, this method also generates a set of convolution kernels {A i} for pixel representation of the image, where i∈[0, N P -1] and uses a random confusion factor α to prevent direct exposure.

[0077] 1.6) Store verification information: In order to verify later, the image owner stores g α , in addition, the image owner does not have to store any additional information.

[0078] Step (2) will process the image file, as Figure 2 shown, generate parameters required in subsequent audits such as authentication elements, specifically:

[0079] 2.1) The image owner will split each large image block I i ∈I into NP×NH×NC small pixel matrices at home, where Ii = {I i，0,0 , I i，0,1 ,..., I i，0,NC×NH-1 ,..., I i，NP-1,NC×NH-1}. Each group of NHimage index matrices is compressed to obtain a hash matrix H i = {H i，0,1 ,..., H i，0,NC-1 ,..., H i，NP-1,NC-1}, where H i，j，l represents the result of the hash operation H(I i，j，l×NH ,..., I i，j，(l+1)NH-1 ), j e [0, NP-1], I e [0, NC-1].

[0080] 2.2) Convolution operation: Weighted aggregation of hash matrices using a convolution kernel of size NC, resulting in convolution coefficients C i = {C i，0 , C i，1 ,..., C i,NP-1}, where C i , m = Conv({H i}, {A i}), Conv represents the convolution operation performed on {H i} using {A i}.

[0081] 2.3) Polynomial representation: Represent each image block I i as a polynomial P i (x) = C i,0 + C i，1 x + C i，2 x 2 +... + C i，NP-1 x NP-1 , resulting in a commitment value P i (o) using a commitment opening point o, the image owner calculates the corresponding data authenticator for each image block as

[0082] 2.4) Calculate snapshot information: Calculate snapshot information sn using the authentication elements generated in the above steps Finally, send the file {I i}, data authenticator {τ i}, and snapshot information sn to the DSP.

[0083] The above is the preprocessing process required for both stages, in addition to the different stages required operations are different, for the subsequent steps of the image audit stage are as follows:

[0084] Step (3) Challenge generation phase: The method generates the challenge parameters required for the audit process using a pseudo-random function based on the challenge parameters;

[0085] Step (4) Evidence generation phase: The method performs the audit task based on the challenge parameters and generates the evidence of the audit process;

[0086] Step (5) Verification phase: The method verifies the correctness of the audit results;

[0087] The specific implementation steps are as follows:

[0088] 3.1) Image owner initiates challenge

[0089] The image owner generates two random keys λ1 and λ2, and specifies the number of image blocks I that need to be checked. Then, the image owner sends (λ1, λ2, I) to the data storage provider (DSP).

[0090] When the DSP receives the challenge parameters, it further generates audit evidence for the challenge, and the specific steps are as follows:

[0091] 4.1) DSP generates challenge set:

[0092] The DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ). Where i is the index of the image block, generated using the pseudo-random permutation function π λ1 (k); η i is a random coefficient generated by the pseudo-random function f λ2 (k). The DSP accepts the image blocks {Ii} of these challenges, the random coefficient η i , and a convolution kernel matrix called αAi for processing the image blocks.

[0093] 4.2) DSP calculates proof π:

[0094] The DSP calculates the proof π using the image audit circuit Ψ: π ← Prove Ψ (pk d , {αA i}, Ψ, {I i} i∈Ω , {η i} i∈Ω , C a ), where Ca is the linear aggregation coefficient

[0095] 4.3) DSP generates auxiliary proof ω τ :

[0096] The DSP generates the auxiliary proof ω for the image blocks I jGenerating auxiliary proof ω τ : where, It is worth noting that this proof is generated based on the remaining unchallenged image blocks to ensure that all blocks that are not directly checked are still valid.

[0097] 4.4) DSP sends all results to the image owner in a package:

[0098] The DSP will package the calculated proof π and auxiliary proof ω τ into a whole proof Prf and send it to the image owner.

[0099] Finally, in step (5), the smart contract (SC) performs the verification operation, which verifies the proof information sent by the DSP to determine whether the DSP has performed the correct audit operation according to the challenge. The specific steps in step (5) are:

[0100] 5.1) Generate challenge set and reconstruct proof:

[0101] After receiving the proof, the SC first regenerates the challenge set Ω using the same challenge parameters (λ1, λ2,, ) to ensure that it is consistent with the DSP's calculation results.

[0102] 5.2) Verify the correctness of the ZKP circuit:

[0103] The SC uses vk d (circuit verification key), proof π, and public witness Ca (composed of the coefficient set of the proof polynomial P(x)) to verify whether the ZKP circuit Ψ is correct: to ensure that there are no errors in the calculation.

[0104] 5.3) Verify the calculation result of the circuit:

[0105] The SC uses the locally stored public parameters γi and g α to verify the calculation result of the circuit. This step uses the bilinear pairing operation to ensure the correctness of the calculation result:

[0106] 5.4) Verify the auxiliary proof using auxiliary verification information μ:

[0107] Since the SC cannot access the private value χ, the verification process relies on the auxiliary verification information μ to verify the correctness of ω τ . By the formula the SC can ensure that the unchallenged data blocks are also correct. If all verification formulas are true, the proof process passes and the data integrity is confirmed. If any verification step fails, the SC will report failure and terminate the audit process.

[0108] So far, the image auditing phase is completed, as shown in Figure 3 The following specific steps for dynamic updating are as follows:

[0109] Step (3) evidence generation phase: the method performs semantic level update based on operation parameters, and generates evidence of the update process;

[0110] Step (4) verification phase: the method verifies the correctness of the update operation;

[0111] The specific implementation details are as follows:

[0112] In step (3), the image owner wants to update the image data, which first updates the image I locally, in order to update the image information stored at the DSP, the DSP needs to perform the update operation, that is, to complete the operation intended by the image owner, and to generate the proof of the operation process, and finally to send it to the image owner for verification, but the process of DSP updating in this method does not require the data owner to participate additionally, and the specific steps in step (3) are as follows:

[0113] 3.1) After receiving the modification information including the image I, the proof parameter λ3, the operation type op and the operation parameter, the DSP loads the original image I, and selects the appropriate dynamic update circuit φ op from the library according to the operation type op. Then, the DSP determines the set Δ = {(i, η i )} for the specified image I, where i is the index of the image block {I i}, and η i is the random coefficient corresponding to the index; an example of dynamic update circuit design is shown in Figure 4 .

[0114] 3.2) Select dynamic update circuit: select the appropriate dynamic update circuit φ op according to the operation type op, and load the original image I.

[0115] 3.3) In order to ensure that the image operated is the one the user wants, the convolution coefficient C i，j {i∈Δ,j∈[0,N P -1] of the current image I needs to be obtained, and the polynomial is constructed, and the aggregated coefficient C a is obtained.

[0116] 3.4) Use the dynamic update circuit φ op , according to the original image I, the updated image I', the coefficient C a and the blinded convolution kernel matrix αA i, DSP executes dynamic update circuit φ o p, get the proof of the circuit:

[0117] 3.5) Calculate auxiliary proof:

[0118]

[0119] Then, the DSP sends the auxiliary evidence ω τ , circuit proof π, coefficient information C a and image data authentication meta τ {i} to the data owner for verification.

[0120] Finally, in step (4), the data owner performs the verification operation, which verifies the proof information sent by the DSP to determine whether the DSP has performed the correct update operation as intended by the data owner. The specific steps in step (4) are as follows:

[0121] 4.1) Verify the dynamic update circuit calculation using the verification key of the circuit: If the verification is passed, it means that the image pixel operation performed by the DSP is consistent with the result executed by the image owner locally, which verifies the correctness of the operation.

[0122] 4.2) Verify the coefficient information sent by the DSP to determine whether the DSP has operated on the original data. This step is equivalent to the verification of the audit process:

[0123]

[0124] 4.3) Check the auxiliary evidence:

[0125]

[0126] If all the equations are true, the update verification is passed. This means that the DSP operation meets the expectations of the data owner, and during the entire dynamic audit process, the user has not performed additional operations, effectively reducing the computational overhead of the data owner.

[0127] Example 2

[0128] Suppose there is a decentralized medical image storage platform, and hospitals as image owners store patients' medical scan images on decentralized storage service providers (DSPs) to reduce storage costs and improve data availability and security. The hospital wants to ensure that the DSP cannot tamper with the image content without the hospital's permission through a dynamic audit mechanism, while also being able to remotely update the image data, such as adding labels or annotations, and ensure the correctness of the update.

[0129] The following embodiment describes in detail how to apply the method in reality, simulating the dynamic updating process of a patient's scan image.

[0130] Scenario description:

[0131] The hospital uploads the MRI scan image of patient X to the decentralized storage platform. The hospital wants to operate on the tumor area in the image and update the image through the decentralized storage service (DSP). In order to ensure that the DSP correctly performs the update operation on the image and guarantee the integrity of the image during storage, the hospital applies the dynamic audit method to verify the update of the DSP.

[0132] Specific steps:

[0133] Step (1) Generate the required parameters and keys:

[0134] The hospital as the image owner needs to perform initialization operation first, generating the required parameters in the audit process.

[0135] 1.1) Split the image file:

[0136] The hospital splits the MRI scan image I of patient X into multiple pixel blocks {I i}, the image is divided into several pixel blocks of 128*128 to 16*16, so that different regions can be operated independently. The image is usually stored in uint8 (8-bit unsigned integer) format, representing the pixel value range of the grayscale image as 0-255. Each 128*128 pixel block occupies 16KB of space.

[0137] 1.2) Select the generator:

[0138] Select the generator g and h in the cyclic group G1. Randomly select the commitment opening point o and the private value χ, o is a random number in the finite field F_p, χ is also in the finite field F_p, usually with a size of 256 bits, and calculate the public parameter Here N P is the degree of the polynomial P(x). γ i is the exponent operation of the generator in the polynomial commitment scheme, These parameters will be used in the polynomial commitment scheme to ensure the integrity of each pixel block.

[0139] 1.3) Generate auxiliary verification information:

[0140] For each pixel block I i , the hospital generates 256-bit auxiliary verification information These auxiliary information will verify the authenticity and integrity of the pixel block in the subsequent audit.

[0141] 1.4) Create ZKP Circuit:

[0142] The hospital designs two types of zero-knowledge proof circuits (ZKP circuits) for image dynamic auditing:

[0143] Update sub-circuit: handles pixel-level update operations such as image marking instructions sent by the hospital, such as image grayscale processing, image cropping, image contrast adjustment, etc.

[0144] Representation sub-circuit: ensures that the image stored on the DSP has not been tampered with and is consistent with the hospital's original image, which is very important for the patient's condition, and any related forgery or modification will cause irreparable consequences.

[0145] The hospital generates a ZKP circuit based on the specific image operation (such as adding a mark), and generates a key pair (pk i , vk i ), where pk i is the proof generation key for updating the image, and vk i is the key for verifying the update, which can be 256 bits to 512 bits in length depending on security requirements.

[0146] 1.5) Generate convolution kernel:

[0147] The hospital generates a set of random convolution kernels {A i} to represent each pixel block I i , usually a 3x3 or 5x5 matrix, the size depends on the requirements of the convolution operation. Each element is an integer in a finite field, and the confusion factor α is used to protect the convolution kernel to avoid direct exposure of the content of the convolution operation.

[0148] 1.6) Store verification information:

[0149] The hospital stores g α locally as necessary information for subsequent verification of pixel block authentication elements. The hospital does not need to store other additional information, reducing the local storage burden.

[0150] Step (2): Process the image to generate authentication elements:

[0151] 2.1) Image segmentation and hashing:

[0152] The hospital further divides each pixel block I i into multiple small pixel matrices and generates a hash value H i for each pixel matrix to ensure the integrity of the image data. The hash operation here can use a hash function such as SHA-256 or SHA-3 to generate a 256-bit hash value.

[0153] 2.2) Convolution operation:

[0154] Hospital generates hash matrix H for each pixel block i Perform convolution operation, generate convolution coefficients C i These convolution coefficients will be used for the generation of the subsequent image authenticator.

[0155] 2.3) Polynomial commitment:

[0156] Hospital expresses each pixel block as a polynomial P i (x) using polynomial commitment and computes the commitment value P i (o). Then, the hospital generates an authentication element for each pixel block For subsequent auditing, each authentication element is an element in the group G_1 with size 256 bits.

[0157] 2.4) Compute snapshot information:

[0158] Hospital computes snapshot information and sends the pixel blocks, authentication elements, and snapshot information to the DSP.

[0159] After the preprocessing process described above is performed, the hospital should send random challenges at irregular intervals to check whether the data stored on the DSP is complete, and the steps of the auditing phase are as follows:

[0160] Step (3) Challenge generation:

[0161] 3.1) Image owner initiates challenge

[0162] The hospital (image owner) generates two random keys λ1 and λ2. These two keys will be used to generate image block indices and random coefficients to ensure the randomness of the challenge. For example, λ1 and λ2 can be random numbers of 128 bits. At the same time, the hospital decides the number of image blocks to be checked I, assuming that the hospital wants to check 5 image blocks. I is an integer, for example, of type uint32, indicating the number of blocks to be checked. The hospital sends (λ1, λ2, I) to the DSP. These parameters will be used to generate the challenge set Ω.

[0163] Step (4) Evidence generation:

[0164] 4.1) DSP generates challenge set:

[0165] The DSP generates the challenge set Ω using the received keys λ1 and λ2. The index i of the image block is generated using the pseudo-random permutation function π λ1 (k). That is, I blocks are randomly selected from the image blocks from 1 to n. The pseudo-random coefficient η i is generated by the pseudo-random function f λ2(k) Generate, for providing randomness in the subsequent computation. Suppose the image blocks to be challenged are Ω = (3, η3), (5, η5), (7, η7), (11, η11), (15, η15). Each ηi is an element in the finite field F 11 . 15 i p

[0166] In addition, the DSP accepts the challenged image blocks {Ii} and the corresponding convolution kernel matrices αAi, which are used in the subsequent computation. The convolution kernel matrices αAi are of size 3x3 or 5x5, each element of which is in a finite field, and the matrix size is related to the processing requirements of the image blocks.

[0167] 4.2) DSP computes the proof π :

[0168] The DSP uses the audit circuit Ψ to process the above image blocks, random coefficients, and convolution kernel matrices, and calculates the proof π . The proof process is carried out by linear aggregation coefficients Ca and the set of challenge blocks: π ← Prove Ψ (pk d , {αA i}, Ψ, {I i} i∈Ω , {η i} i∈Ω , C a ), where Ca is the linear aggregation coefficient

[0169] 4.3) DSP generates auxiliary proof ω τ :

[0170] The DSP generates an auxiliary proof ω τ for the image blocks {Ij} that are not challenged, ensuring that the blocks that are not directly checked are also complete. The auxiliary proof ω τ is generated by the coefficients θ of the remaining blocks. θ is the coefficient of the polynomial used to represent these unchallenged blocks

[0171] 4.4) DSP packs the proof:

[0172] The DSP packs the proof π and the auxiliary proof ω τ into an overall proof Prf and sends it to the hospital (image owner). The proof is a data packet containing all the computation results.

[0173] Step (5) Verification phase:

[0174] 5.1) Generate the challenge set and reconstruct the proof: ​​​

[0175] The SC (Smart Contract) regenerates the challenge set Ω using the previous challenge parameters (λ1, λ2, I) upon receiving the proof to ensure it is consistent with the DSP's calculation result.

[0176] 5.2) Verify the correctness of the ZKP circuit:

[0177] The SC uses the verification key vk d , the proof π, and the public witness Ca to verify whether the circuit Ψ's calculation is correct: vk d is the key for circuit verification, which can be 256 bits or 512 bits in size.

[0178] Step 5.3) Verify the calculation result of the circuit:

[0179] The SC uses the locally stored public parameter γ i and = g α to verify the calculation result of the circuit. This step uses the bilinear pairing operation to ensure the correctness of the calculation result:

[0180] 5.4) Verify ωτ using auxiliary verification information μ:

[0181] Since the SC cannot access the private value χ, the verification process relies on auxiliary verification information μ to verify the correctness of ω τ . Verification is done through the formula , ensuring that the data blocks not challenged are also complete. If all verification formulas are valid, the proof process passes, and the data integrity is confirmed. If any verification step fails, the SC will report a failure and terminate the audit process.

[0182] The above is the entire process of the audit phase. In addition to the audit process, the hospital should also be able to dynamically update the data on the DSP. The specific implementation steps of this phase are as follows:

[0183] Step (3) Image Update:

[0184] The hospital decides to update the MRI image of patient X stored in the DSP, and performs contrast adjustment on the image to increase the visibility of the image.

[0185] 3.1) Submit an update request:

[0186] The hospital submits an image update request to the DSP, including the updated proof parameter λ3 (used to generate random values in the audit), the operation type op (such as contrast adjustment operation), and the operation parameters (such as the value of the α parameter in the adjustment process).

[0187] 3.2) DSP selects an update circuit:

[0188] The DSP selects the corresponding dynamic update circuit φ according to the operation type op op to process the image update. For example, in the context of contrast adjustment, the update circuit selected by the DSP will handle the color changes in the specified region.

[0189] 3.3) The DSP obtains the convolution coefficients:

[0190] The DSP calculates the convolution coefficients of the current image, and constructs the polynomial and obtains the aggregated coefficients C a . To confirm that the update result of the image is consistent with the expectation.

[0191] 3.4) Execute the update circuit:

[0192] The DSP uses the update circuit φ op to perform the update operation according to the original image I and the update parameters specified by the hospital, generating a new image I'. The DSP also generates the proof π of the circuit: to prove the correctness of the update operation, which is usually 512 bits or longer, depending on the complexity of the ZKP.

[0193] 3.5) Calculate the auxiliary proof:

[0194] The DSP generates the auxiliary proof ω τ : and sends the proof π, convolution coefficients C a and authentication meta τ i to the hospital for verification.

[0195] Step (4): The hospital verifies the update operation of the DSP:

[0196] 4.1) Verify the dynamic update circuit calculation:

[0197] After receiving the update result and proof from the DSP, the hospital uses the verification key vk i to verify whether the dynamic update circuit calculation is correct: If the verification is passed, the hospital can confirm that the DSP has correctly performed the change operation.

[0198] 4.2) Verify the convolution coefficients:

[0199] The hospital verifies the convolution coefficients C a sent by the DSP to confirm whether the DSP has updated the image according to the hospital's instructions. This step is equivalent to an audit operation, ensuring that the DSP has not tampered with the original data:

[0200]

[0201] 4.3) Check the auxiliary proof:

[0202] Hospital check auxiliary proof omega τ To verify the behavior of the DSP in the update operation. The hospital verifies the auxiliary evidence by the following equation:

[0203]

[0204] If all the verifications pass, the hospital can confirm that the update operation performed by the DSP is correct and there is no unauthorized tampering.

[0205] The application proposes an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, which can support semantic-level updates in the auditing process, and eliminates the dynamic operation overhead generated by the data owner side auditing. Experimental results show that the scheme has advantages in storage overhead and computing overhead.

[0206] The above-described embodiments only express the specific implementation of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. An efficient pixel-level dynamic image auditing method in a zero-knowledge proof-based decentralized storage, characterized in that, The method comprises the following steps: Step 1, preprocessing stage: processing image files to generate and store method parameters required for subsequent stages, and authentication elements and snapshot information based on file content; In step 1, the method for generating the method parameters specifically comprises the following steps: A. Splitting the image file: The data owner splits the image file I into a plurality of image blocks {I i} ; B. Selecting a generator: Select a generator g and h in the cyclic group G1; to use a polynomial commitment scheme, randomly select a commitment opening point o and a private value χ, while computing public parameters where the public parameters N P is the degree of the polynomial P(x); C. Generating auxiliary verification information: For each image block I i , generate auxiliary verification information μ i , where D. Create ZKP arithmetic circuit: based on different image operations, create ZKP arithmetic circuit φ for image dynamic audit, and generate key pair (pk i ,vk i ,pk d ,vk d ), the key pair is used to participate in the subsequent evidence generation and verification link; E. Generating convolutional kernels: A set of convolutional kernels {A i} is generated for the pixel representation of the image, where i ∈ [0, N P -1], and a random obfuscation factor a is used to prevent direct exposure; F. Store verification information: The image owner stores g α locally In step 1, the method for generating authentication elements and snapshot information based on file content specifically comprises the following steps: a. The image owner splits each large image block I i ∈ I into NP x NH x NC small pixel matrices locally, where I i = {I i,0,0 ,I i,0,1 ,…,I i,0,NC×NH-1 ,…,I i,NP-1,NC×NH-1}; each group of NH pixel matrices is compressed to obtain a hash matrix H i = {H i,0,1 ,…,H i,0,NC-1 ,…,H i,NP-1,NC-1}, where H i,j,l represents the result of the hash operation H(I i,j,l×NH ,…,I i,j,(l+1)NH-1 ), j ∈ [0, NP - 1], l ∈ [0, NC - 1]; b. Convolution operation: Weighted aggregation of the hash matrix using a convolution kernel of size NCresults in convolution coefficients C i = {C i,0 ,C i,1 ,…,C i,NP-1}, where C i ,m= Conv({H i}, {A i}), Conv denotes a convolution operation performed on {H i} using {A i}; c. Polynomial representation: Each image block I is represented using a polynomial commitment i For a polynomial P i (x) = C i,0 + C i,1 x + C i,2 x 2 +... + C i,NP-1 x NP-1 , resulting in a commitment value P i (o), where the commitment opening point o is used, the image owner computes the respective data authenticator for each image block as d. computing snapshot information: using the generated authentication meta to compute snapshot information Finally the file {I i} the data authenticator {τ i} and the snapshot information sn are sent to the service provider DSP; Step 2, image auditing stage: generating challenge parameters required for the auditing process using a pseudo-random function, performing an auditing task based on the challenge parameters, generating evidence of the auditing process, and verifying the correctness of the auditing result; In step 2, generating evidence of the auditing process specifically comprises the following steps: (1) Image owner initiates challenge: the image owner generates two random keys λ1 and λ2, and specifies the number of image blocks I that need to be checked; then, the image owner sends (λ1, λ2, I) to the data storage provider DSP; (2) DSP generates a challenge set: DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ); where i is the index of the image block, using the pseudo-random permutation function π λ1 (k) generation; η i is a random coefficient, generated by the pseudo-random function f λ2 (k) generation; the DSP accepts the challenged image block {Ii} and the random coefficient η i , and a convolution kernel matrix called αAi, which is used to process the image block; (3) The DSP computes the proof π: π ← Prove Ψ (pk d ,{αA i},Ψ,{I i} i∈Ω ,{η i} i∈Ω ,C a ), where Ca is a linear aggregation coefficient (4) DSP generates an auxiliary proof ω τ : DSP on image blocks I that are not challenged j Generating an auxiliary proof wherein, (5) DSP sends all results to the image owner: DSP sends the computed proof π and the auxiliary proof ω τ packaged into one overall proof Prf and sent to the image owner; Step 3, image updating stage: performing semantic-level updates based on operation parameters, generating evidence of the updating process, and verifying the correctness of the updating operation; In step 3, generating evidence of the updating process specifically comprises the following steps: op on receiving modification information comprising an image I, attestation parameters λ3, an operation type op and operation parameters, the DSP loads the original image I and selects the appropriate dynamic update circuit φ from the library according to the operation type op op to perform subsequent calculations; the DSP then determines, for the specified image I, the set Δ = {(i, η i ), where i is the index of an image block {I i} and η i is the random coefficient corresponding to that index; ii. selecting a dynamic update circuit: selecting an appropriate dynamic update circuit φ according to the operation type op op , and loading the original image I; ③ Obtain the convolution coefficient of the current image I C i,j {i∈Δ,j∈[0,N P -1],and construct a polynomial and obtain the aggregated coefficient C a ; (4) using a dynamic update circuit φ op , according to the original image I, the update image I', the coefficient C a and the blind convolution kernel matrix αA i , the DSP executes the dynamic update circuit φ o p, the proof of the circuit is obtained: (5) Calculate auxiliary proof: Then, the DSP sends the auxiliary evidence ω τ , the circuit proof π, the coefficient information C a and the authentication meta τ {i} of the image data to the data owner for verification; In step 3, verifying the correctness of the updating operation specifically comprises the following steps: i. Use the circuit’s verification key to verify the dynamically updated circuit calculation: If the verification passes, it means that the image pixel operation performed by the DSP is consistent with the result performed locally by the image owner, verifying the correctness of the operation; ii. Verify the coefficient information sent by the DSP to determine whether the DSP has operated on the original data, which is equivalent to verifying the auditing process once: iii. Check the auxiliary evidence at the same time: If all the equations are true, the update verification is passed.

2. The method for efficient pixel-level dynamic image auditing in zero-knowledge proof based decentralized storage according to claim 1, characterized in that, In step D, the method for creating the ZKP arithmetic circuit specifically comprises the following: The data storage provider DSP selects different circuits according to the request of the image owner, performs pixel-level updates on the locally stored original image, and provides proof of the entire updating process; then sends the proof to the image owner for verification; a circuit module is designed to represent the original image, i.e. to perform an audit on the original image, to operate on the original image to obtain its correct representation, and the representation information is sent to the image owner for verification.

3. The method for efficient pixel-level dynamic image auditing in zero-knowledge proof based decentralized storage according to claim 2, characterized in that, The ZKP arithmetic circuit specifically comprises: An updating sub-circuit for performing pixel-level processing on the original image according to different operation parameters; A representation sub-circuit for operating on the original image to obtain a representation closely related to the original image.

4. The method for efficient pixel-level dynamic image auditing in zero-knowledge proof based decentralized storage according to claim 1, characterized in that, In step 2, when verifying the correctness of the auditing result, the smart contract SC performs verification operations by verifying the proof information sent by the DSP to determine whether the DSP has performed correct auditing operations according to the challenge, specifically comprising the following steps: 1) Generate challenge set and reconstruct proof: after receiving the proof, the SC first uses the same challenge parameters (λ1, λ2, I) to regenerate the challenge set Ω to ensure that it is consistent with the calculation result of the DSP; 2) Verify correctness of ZKP circuit: SC uses circuit verification key vk d , proof π and public witness Ca to verify that ZKP circuit Ψ is correct: Ensure no faulty computation; 3) Verify the result of the computation of the circuit: SC uses the locally stored public parameter γ i and g α Verify the result of the computation of the circuit, ensuring the correctness of the result of the computation: 4) Verify the auxiliary proof using the auxiliary verification information μ: by formula The SC ensures that the data blocks not challenged are also correct; if all verification formulas hold, the proof process passes and the data integrity is confirmed; if any verification step fails, the SC reports the failure and terminates the audit process.

Images